Latest CyberSec News by @thecyberpicker

A new TrickMo Android banking trojan variant uses TON blockchain infrastructure for stealthy command-and-control communications.

AI agent security is real and now. Scope violations are common; learn how runtime enforcement, ownership, and governance help curb autonomous behavior.

This week in cybersecurity from the editors at Cybercrime Magazine

Critical SOC alerts go uninvestigated as static AI triage limits coverage, increasing enterprise breach risks.

Attackers are exploiting cPanel flaw CVE-2026-41940 to install the Filemanager backdoor and gain unauthorized admin access.

Responding to a state-sponsored threat is nothing like responding to ransomware, and the differences can make or break the outcome. Learn why your IR plan might need revisiting, and the factors you should consider.

A large-scale software supply-chain attack involving the "Shai-Hulud" malware has compromised hundreds of packages across open-source software ecosystems.

OpenAI a présenté, le 11 mai 2026, Daybreak, une plateforme d’IA dédiée à la cybersécurité. L’entreprise entre à son tour dans la course aux IA spécialisées dans la cyberdéfense, quelques semaines après les annonces d’Anthropic autour de Claude Mythos. Tandis qu’Anthropic a provoqué un mini-séisme dans le secteur de

Agentic AI expands enterprise attack surfaces through broad permissions and unreviewed deployments, increasing lateral movement risks.

This is the worst Linux vulnerability in years. TL;DR copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC. It abuses the kernel crypto API (AF_ALG sockets) plus splice() to write four bytes at a time straight into the page cache of a file the attacker does not own. The exploit works unmodified across Ubuntu, RHEL, Debian, SUSE, Amazon Linux, Fedora and most others. No race condition, no per-distro offsets. The file on disk is never modified. AIDE, Tripwire and checksum-based monitoring see nothing. ...

SAP has released the May 2026 security updates addressing 15 vulnerabilities across multiple products, including two critical flaws in the Commerce Cloud enterprise-grade e-commerce platform and the S/4HANA ERP suite.

AI is fundamentally restructuring the cybersecurity landscape by accelerating venture funding cycles, shrinking the window from seed to Series A, and forcing a rapid consolidation through M&A.

WannaCry showed how unpatched flaws and leaked cyber tools can cripple global systems, reshaping cybersecurity defenses worldwide.

Instructure, the edtech giant behind the widely popular Canvas learning management system (LMS), has reached an "agreement" with the ShinyHunters extortion group to prevent the data stolen in a recent breach from being leaked online.

Cifas just published research that should bother anyone who runs a business, or buys from one.

Instructure says the stolen Canvas data impacting millions of students and staff was “returned.” That’s not how breaches work.

TeamPCP’s Mini Shai-Hulud campaign used hijacked GitHub OIDC tokens to spread a credential-stealing worm through TanStack npm packages.

A new TrickMo Android trojan focused on stealth and persistence, moving its command-and-control traffic to the TON network.

OpenAI launched Daybreak with GPT-5.5-Cyber tools as AI accelerates vulnerability discovery and exploit timelines.

Instructure paid a ransom after hackers stole 275 million Canvas records, reducing risks of wider extortion and leaks.

Kaspersky researchers are sharing insights into the main ransomware trends for 2026: EDR killers on the rise, switching from data encryption to data leaks, and more.

A report by GTIG shows threat groups are increasingly leveraging AI to scale attacks. The exploitation attempt was disclosed and patched, preventing a mass incident.

Attackers affiliated with The Com are threatening to leak data from more than 8,800 school systems if Instructure doesn’t pay a ransom.

California Attorney General Rob Bonta announced a proposed $12.75 million settlement agreement with General Motors (GM) over allegations that the company violated the California Consumer Privacy Act (CCPA).

A security researcher has released a proof-of-concept tool named GhostLock that demonstrates how a legitimate Windows file API can be abused in attacks to block access to files stored locally or on SMB network shares.

Checkmarx warned over the weekend that a rogue version of its Jenkins Application Security Testing (AST) plugin had been published on the Jenkins Marketplace.

TeamPCP compromised a Checkmarx Jenkins plugin in 2026, exposing supply chain security gaps and credential risks.